diff options
| author | rfjakob | 2018-06-02 13:22:33 +0200 |
|---|---|---|
| committer | rfjakob | 2018-06-02 13:22:33 +0200 |
| commit | 349ff7700bda615cc9153eee0029440f734c2b66 (patch) | |
| tree | ae1282588a356e73ac6993555753c948bee430be | |
| parent | fe2f4c5e751480e43e745eda005562f963929271 (diff) | |
Created Password Strength (markdown)
| -rw-r--r-- | Password-Strength.md | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/Password-Strength.md b/Password-Strength.md new file mode 100644 index 0000000..7ebbac7 --- /dev/null +++ b/Password-Strength.md @@ -0,0 +1,15 @@ +I recommend between 64 and 128 bits of entropy. Depending on the character set, this translates to the password lengths below, when the passwords are randomly generated (using KeePass etc): + +Character Set | Password length | Password length +-- | -- | -- +(number of different characters) | for >= 64 bits of entropy | for >= 128 bits of entropy +`0-9` (10) | 20 | 39 +`a-z0-9` (36) | 13 | 25 +`A-Za-z0-9` (62) | 11 | 22 +`A-Za-z0-9%$&/...` (95) | 10 | 20 + +gocryptfs uses *scrypt* password hashing. The [scrypt paper](https://www.tarsnap.com/scrypt/scrypt.pdf) includes this table that estimates the cost for cracking a password in one year: + + + +So it would cost 43 Billion Dollars to crack a 64-bit password. Adding another alphanumeric character multiplies the cost by 62.
\ No newline at end of file |